Data protection
Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) implements the GDPR: the digital age of consent is 14 (article 7); the rights of access, rectification, erasure, portability, restriction and objection are exercised against the controller with a reply within one month and a free complaint to the AEPD, which can impose fines of up to 20 million euros or 4 % of turnover (more than 100 million in 2024, with records against banks, telecoms and platforms); the law adds digital rights: disconnection at work, digital testament (article 96), the right to be forgotten in search engines and social networks (articles 93 and 94), and protection of minors. Article 197.7 of the Penal Code (since 2015) punishes with 3 months to 1 year the unauthorised sharing of intimate images or recordings obtained with consent in private, aggravated if the victim is a partner or former partner, a minor or vulnerable; article 197.1 punishes interception and access to data with 1 to 4 years, and the Penal Code as reformed in 2025 punishes sexual deepfakes. The AEPD opened in 2019 the Priority Channel (canalprioritario.aepd.es) for the urgent removal of sexual or violent content shared without consent, acting within hours with fines of up to 10,000 euros for the sharer. Dating apps established outside Spain answer to their lead authority (Ireland for Tinder and Bumble), with the AEPD as a concerned authority.
British residents in Spain are protected by the GDPR as applied by the AEPD, which is stricter and faster than the UK's ICO in enforcement; UK residents dealing with a Spanish company (a property portal, a clinic, a bank) are protected too, because the GDPR applies to any controller established in the EU. The UK GDPR, largely identical, governs UK-established companies; the two regimes recognise each other's adequacy for data transfers, so a British customer's data may move between the two countries freely.
The AEPD's Priority Channel has no British equivalent: an intimate image shared without consent can be taken down within hours on an administrative order, without a court. In the UK the route is a report to the police (sharing intimate images is an offence under the Online Safety Act 2023 and the Sexual Offences Act) and a request to the platform, with the Revenge Porn Helpline's assistance; a victim in either country can use both systems.
Key points
| Law | GDPR and Organic Law 3/2018 (LOPDGDD); AEPD as regulator (fines up to 20 million euros or 4 %) |
|---|---|
| Rights | Access, rectification, erasure, portability, restriction, objection; right to be forgotten in search engines and networks; digital testament |
| Minors | Digital consent at 14 (13 in the UK) |
| Intimate images | Unauthorised sharing: 3 months to 1 year, aggravated if partner or former partner (article 197.7); sexual deepfakes punished; AEPD Priority Channel for removal within hours |
| Complaint | Free to the AEPD after the controller's reply or silence within a month |
| UK residents | GDPR rights against Spanish controllers; UK-EU adequacy allows free data flows; ICO and AEPD cooperate |
| Figures | More than 100 million euros of AEPD fines in 2024; more than 20,000 complaints a year; the Priority Channel handles hundreds of cases, mostly young women |
In practice
- Exercise your rights with the app or company (form, email of the data protection officer) and, without a reply within a month, complain online to the AEPD with a copy of your request; the AEPD decides within months and can fine. A UK resident may complain to the ICO, which will forward to the AEPD, or directly to the AEPD in Spanish or English.
- Faced with an intimate photo or video shared without consent: capture the evidence (URL, date, profile), use the AEPD's Priority Channel (removal within hours), report to the Policía Nacional or Guardia Civil (article 197.7) and notify the platform; do not negotiate with the sharer.
- Requesting access to your data from a dating app reveals messages, locations and internal profiles; request complete erasure when closing the account (uninstalling is not enough).
- Children under 14 cannot consent on their own: dating apps require 18, and access by minors is reported to the AEPD and the platform.
- To de-index search results under your name, use Google's or Bing's form with an appeal to the AEPD; INCIBE's 017 line advises on account security.
Cost and coverage
Exercise of rights, Priority Channel and complaints to the AEPD free; civil actions with a lawyer (legal aid according to income).
Recent changes
The AEPD exceeded 100 million euros of fines in 2024; the Penal Code was reformed in 2025 to punish sexual deepfakes; the Organic Law on the protection of minors in digital environments (2025) strengthened age verification; the Priority Channel extended its scope to AI-generated content. The UK-EU adequacy decisions were renewed in 2025.
Where to go
- AEPD (aepd.es): complaints and Priority Channel (canalprioritario.aepd.es).
- Policía Nacional and Guardia Civil: reports for sharing intimate images.
- 017 — INCIBE: security of accounts and devices.
- In the UK: the ICO (ico.org.uk) and the Revenge Porn Helpline (revengepornhelpline.org.uk).
Worth knowing
The AEPD's Priority Channel is unique in Europe: a shared intimate image can be removed within hours without waiting for a judge. Use it before anything else, and report afterwards: the offence under article 197.7 exists even if the photo was sent voluntarily to a partner. And a British resident's rights are as strong as a Spaniard's — the GDPR does not ask for nationality.
Frequently asked questions
I live in the UK and a Spanish company is misusing my data — who do I complain to?
Either the ICO, which forwards cross-border complaints to the AEPD under the cooperation arrangements, or the AEPD directly through its online form, which accepts complaints from anyone about controllers established in Spain. Write to the company's data protection officer first, citing article 15 or 17 of the GDPR, and keep proof of the date: the AEPD asks whether you did.
Is the digital age of consent different in Spain?
Yes: 14 in Spain, 13 in the UK. Below 14 a Spanish service must obtain a parent's consent for a child's account; dating apps require 18 in both countries. Parents can demand the deletion of a Spanish account opened by a child under 14 without their consent, and report the platform to the AEPD.
Sources
- Organic Law 3/2018 on Personal Data Protection and digital rights — BOE
- AEPD — Priority Channel — urgent removal of intimate content
- ICO — complaints about organisations abroad — UK regulator
The general article: Data protection · Compare with another country
Romance scams
Fraud is punished with 6 months to 3 years, 1 to 6 years above 50,000 euros or where the victim's vulnerability was abused, and 4 to 8 above 250,000 (Penal Code, articles 248 to 250, reformed in 2022); report to the Policía Nacional, the Guardia Civil or a court, with INCIBE's 017 line for guidance; the bank refunds unauthorised transactions but not transfers ordered by the victim; romance and 'investment' scams cause tens of millions in losses a year, and British retirees on the coasts are a favourite target.
Article 248 of the Penal Code defines fraud (estafa) as deception sufficient to cause error and a disposal of assets to the victim's or a third party's detriment, including by computer manipulation, punished with 6 months to 3 years (a fine if under 400 euros, article 249, as reformed by Organic Law 14/2022); article 250 raises it to 1 to 6 years when the value exceeds 50,000 euros, many people are affected, personal relationships or the victim's vulnerability are abused, or it is committed by forgery or impersonation, and to 4 to 8 years above 250,000 euros. Reports go to any Policía Nacional station (Central Technological Investigation Brigade), Guardia Civil post (Telematic Crime Group), the duty court or the prosecutor; INCIBE's 017 line gives free guidance and the Internet User Security Office publishes alerts. Banks must refund unauthorised transactions within one business day (Royal Decree-Law 19/2018, transposing PSD2) except for the customer's gross negligence, and case law (Supreme Court 2024 and provincial courts) increasingly compels refunds of bank-impersonation fraud (phishing, smishing) where the bank's security failed, but not transfers knowingly made to a virtual 'fiancé'; complaints go to the bank's customer service and then the Bank of Spain. Spain recorded more than 470,000 cybercrimes in 2024, 90 % fraud, with romance scams costing tens of millions a year and victims mostly over 50.
British residents in Spain are targeted by two kinds of fraud: the online romance and 'crypto investment' scams that hit everyone, and Spain-specific schemes aimed at expatriates — fake solicitors and 'recovery agents' for timeshare victims, bogus property-tax refunds, fake gestores and cold-calling 'financial advisers' on the Costa del Sol. Age, isolation and language are the vulnerabilities the scammers exploit, and Spanish police and INCIBE publish alerts in English.
A Spanish bank account: report in Spain (the police can freeze Spanish receiving accounts within hours), complain to the bank and, if refused, to the Bank of Spain. A UK bank account or card: Report Fraud (or Police Scotland) and the UK bank, with the Financial Ombudsman if refused, and since October 2024 the UK's mandatory reimbursement of authorised push-payment fraud up to 85,000 pounds — a protection that does not exist in Spain, where a transfer you made yourself is not refunded.
Key points
| Offence | Fraud: 6 months to 3 years (article 248); 1 to 6 years above 50,000 euros, many victims or vulnerability (article 250); 4 to 8 years above 250,000 |
|---|---|
| Report | Police station, Guardia Civil, duty court or prosecutor; guidance on 017 (INCIBE); some reports online with a digital certificate |
| Bank refund | Unauthorised transactions refunded within a day (RDL 19/2018); bank impersonation increasingly refunded by the courts; voluntary transfers not |
| Platforms | Obliged to remove reported profiles (DSA); dating apps not liable for the damage save negligence |
| Limitation | 5 years for basic fraud, 10 for aggravated |
| UK side | Report Fraud; UK banks must reimburse authorised push-payment fraud up to 85,000 pounds since October 2024; Financial Ombudsman |
| Figures | More than 470,000 cybercrimes in 2024, 90 % fraud (Ministry of the Interior); romance scams: tens of millions in losses, victims mostly over 50 |
In practice
- Report as soon as possible with all the evidence (conversations, profiles, transfer receipts, cryptocurrency addresses): the police can request the freezing of receiving accounts in Spain within hours; ask for a copy of the denuncia — you will need it for the bank and insurers.
- Call the bank immediately to attempt a recall of the transfer; if the receiving account is Spanish and still has funds, it is sometimes recovered.
- Complain in writing to the bank's customer service and, without a reply in 15 days or with a refusal, to the Bank of Spain; for impersonation fraud, civil courts have sided with many victims.
- Report the profile to the platform and to the Internet User Security Office; do not respond to 'recovery agencies' or supposed lawyers or police who make contact afterwards — they are the same network, and timeshare victims are their favourite prey.
- For money sent from a UK account, report to Report Fraud and your UK bank as well: the UK reimbursement rules for authorised push payments may apply even though the fraudster was in Spain.
Cost and coverage
Report and 017 free; complaint to the Bank of Spain free; civil proceedings require a lawyer and procurador above 2,000 euros (legal aid according to income).
Recent changes
Organic Law 14/2022 reordered the penalties for fraud; the Supreme Court strengthened in 2024 the liability of banks in impersonation fraud; verification of the payee's name on transfers came into force in October 2025; the police dismantled in 2024 and 2025 romance-scam networks based in Spain operating from call centres, some targeting British and German pensioners.
Where to go
- 017 — INCIBE: free guidance on cybersecurity and scams (9 am to 9 pm).
- Policía Nacional — Central Technological Investigation Brigade; Guardia Civil — Telematic Crime Group.
- Bank of Spain — complaints against banks; Internet User Security Office (osi.es): alerts and guides.
- Report Fraud (UK) and the Financial Ombudsman Service for UK accounts; British consulates for lists of lawyers.
Worth knowing
The law punishes fraud well, but money sent voluntarily to a stranger is not refunded by a Spanish bank and is rarely recovered by the police once it has left Spain: the only defence is never to send money to someone you have not met in person. The second fraud — 'recovering' the money for a fee — almost always follows the first, and British timeshare owners have paid it for decades.
Frequently asked questions
I sent money from my Spanish account to someone I met online — will my bank refund me?
No, if you authorised the transfer yourself: Spanish law (and EU payment rules) oblige banks to refund only unauthorised transactions. Report to the police at once so the receiving account can be frozen, and ask your bank for a recall. If the fraud involved impersonation of your bank (a call or text that led you to give codes), Spanish courts increasingly order refunds — complain in writing, then to the Bank of Spain.
Does it help to report to Report Fraud as well?
Yes, if any UK account, card or company was involved: Report Fraud feeds UK investigations and your UK bank may have to reimburse an authorised push payment under the rules in force since October 2024. For a purely Spanish loss, the Spanish denuncia is what matters; Report Fraud will not investigate abroad.
How do I recognise the Costa scams aimed at expatriates?
Cold calls or emails offering to recover timeshare money, property-tax refunds or 'compensation' for a fee; 'advisers' selling unregulated investments; fake lawyers and gestores. Check any firm with the CNMV (investments), the Bar association (lawyers) and the official gestor register; never pay upfront for recovery; and ask the consulate or a registered lawyer before paying anything. Genuine refunds from the Spanish tax agency never require a fee.
Sources
- Penal Code — articles 248-251 bis (fraud) — consolidated text
- INCIBE — 017 and guides on scams — National Cybersecurity Institute
- Report Fraud (UK) — reporting fraud involving UK accounts
The general article: Romance scams · Compare with another country
General sources
- Administración General del Estado — administracion.gob.es — official portal of Spanish public services, with pages in English
- Boletín Oficial del Estado (BOE) — Spanish legislation, official and consolidated texts
- British Consulates in Spain — gov.uk — living in Spain guide, consular help, lists of English-speaking lawyers